ClawHub
Back to skill

Security audit

Japan Media Agent

Security checks across malware telemetry and agentic risk

Overview

This skill controls a social-media publishing helper, but its sensitive actions are disclosed and repeatedly gated on explicit user confirmation.

Install only if you trust 96Push and intend to let an agent help manage your connected publishing accounts. Keep the API key local, review the exact account list and draft/live state before approving any publish, and treat deletes, queue cancellation, and platform setting changes as high-impact actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly describes automated publishing and browser automation to external social accounts without any clear warning, confirmation step, or safety boundary around account-affecting actions. In this context, the agent is intended to draft and publish content, so missing user-consent and action-scope safeguards increases the risk of unintended posting, brand damage, or misuse of connected accounts.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal